[SSSD] [PATCHES] SUDO integration - first iteration

Jakub Hrozek jhrozek at redhat.com
Wed Nov 2 18:33:12 UTC 2011


On Mon, Oct 31, 2011 at 06:35:50PM +0100, Jakub Hrozek wrote:
> On 10/10/2011 03:20 PM, Pavel Březina wrote:
> > https://fedorahosted.org/sssd/ticket/623
> > 
> > Helpful links:
> >  - SUDO plugin API
> >    http://www.gratisoft.us/sudo/man/1.8.1/sudo_plugin.man.html
> > 
> > What does it do currently?
> >  1. sudo plugin sends input data to responder
> >  2. responder sends back to plugin that user is allowed to run the
> >     command
> > 
> > What does it not do?
> >  - Doesn't require any PAM authentication
> >  - Doesn't read anything from LDAP
> >  - Doesn't set any environment variables (and reset current environment)
> >    This actually can cause some troubles to applications, so far I've
> >    encountered an error message in VIM (no $HOME specified)
> > 
> > How to test it?
> >  1. Install SUDO version 1.8 or greater
> >     I am running 1.8.2 built from source:
> >       ftp://ftp.sudo.ws/pub/sudo/sudo-1.8.2.tar.gz
> > 
> >  2. Enable SUDO plugin in /etc/sudo.conf
> >     Plugin sss_sudo_policy /usr/lib/sudo/libsss_sudoplugin.so
> > 
> >     Unfortunately, SUDO doesn't allow to have more than one policy
> >     plugin activated, so comment out standard sudoers plugin.
> > 
> >  3. Enable it in sssd.conf ;-)
> >     services += sudo
> > 
> >  4. Run sssd
> > 
> >  5. Run sudo
> > 
> > I left there some debug messages, so don't worry when you see:
> >   CMD Return code: 0
> >   errnop: 0
> >   Command exited with status 0
> > 
> > in the output. But tell me if there is anything else than 0 :-)
> > 
> 
> In overall - good work! Pavel also has follow-up patches, so he wasn't
> idling in the meantime between him sending out this patchset and us
> getting it reviewed. Sorry for the delay, Pavel.
> 
> As sudo does not seem to have a bug tracker upstream and the Red Hat
> sudo maintainer is working with us, I'm going to open one generic "SSSD
> Sudo Feature tracker" bug in bugzilla.redhat.com for Fedora rawhide sudo
> and then one bug per feature we'd like to see in sudo blocking this
> tracker bug.

Turns out sudo upstream has a bug tracker.  We're still going to use RHBZ,
though. The work is going to be done by the Red Hat sudo maintainer and
by using Red Hat Bugzilla, we have the freedom of creating dependencies
etc. I think Daniel can create RFEs upstream if he needs to.

The tracking bug is https://bugzilla.redhat.com/show_bug.cgi?id=750879
The individual subtasks block this tracker.



More information about the sssd-devel mailing list